10 ms·

Why do you think they'd accept an offer? They openly said it's not for sale: https://mullvad.net/en/blog/2021/9/16/ownership-and-future-mullvad-vpn https://mull

Why do you think they'd accept an offer? They openly said it's not for sale: https://mullvad.net/en/blog/2021/9/16/ownership-and-future-mullvad-vpn https://mullvad.net/en/blog/2021/9/16/ownership-and-future-m... Not everyone's in it for the money. Assuming they're not operating at a loss, even less so.

Groxx 2y ago
Not everyone telegraphs if they're in it for the money. In some lines of business, like (purely hypothetically) security, it might actually be a bad thing for your business if you do. I also use mullvad because I don't really think this is the case, but bad actors are generally hard to conclusively identify by design. And VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior.
- reaperman 2y ago
  I think legally they would have to change their ownership directive document in Switzerland to allow the board of directors to allow the two founders to sell more than 50% of their shares. So you might get a heads up!
  - blowfish721 2y ago
    They arent based in Switzerland but in Sweden.
- yencabulator 2y ago
  Mullvad is trying pretty darn hard to be as far from "just trust me bro" as is feasible. If you do take their word for how they run their systems (/are working toward), their servers are diskless (what logs?), will only run software signed by their infrastructure team, and will remotely attest that their software has not been tampered with. This is so very, very, far away from the typical VPN company that any such comparison sounds ridiculous to me. Just the pretense of doing all this work costs so much that a greedy biz bro simply wouldn't. https://github.com/mullvad/system-transparency https://github.com/mullvad/system-transparency https://www.system-transparency.org https://www.system-transparency.org https://news.ycombinator.com/item?id=29903695 https://news.ycombinator.com/item?id=29903695
  - kfreds 2y ago
    Thank you for noticing! System Transparency is taking way longer to figure out, design and build than I expected. On the other hand the project is quite ambitious, and our work on ST has sprouted two additional OSS projects: - https://www.sigsum.org https://www.sigsum.org (a transparency log with witness cosigning) - https://tillitis.se https://tillitis.se (an open-source hardware FPGA-based security key with measured boot)
  - fragmede 2y ago
    > a greedy biz bro simply wouldn't. On the other hand, if it were an NSA honeypot, doing all that work would easily be worth the cost. Personally, I don't think they are, so I'm merely pointing out that there are angles other than totally above-board honest legitimate reasons, and "greedy biz bro".
    - yencabulator 2y ago
      For sure. Them being Swedes with a long track record decreases that probability a lot.
- kfreds 2y ago
  > VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior. Yes. It is quite an interesting situation, really. It's also a fun challenge! To what extent can we prove that we are trustworthy, and using what tools? Do those tools exist or do we have to invent them?
  - fragmede 2y ago
    You'd have to invent this one at least, as it currently doesn't exist. As the DNS server operator, you can view all my DNS queries. In a zero-trust environment where I don't trust you not to log all user queries and forwards them to the NSA, you'd need to use homomorphic encryption and create a DNS client and server than can do a lookup, without you, the DNS server operator, from finding out what the DNS lookup was of. https://github.com/menonsamir/spiral-rs https://github.com/menonsamir/spiral-rs claims to have implemented this at a level that's practical for real world applications, with a demo for a wikipedia server, but it's far too slow, as demoed, for use as DNS server. Now, the fact of the matter is that you can map my account ID back to the IP I'm connecting from, but with very limited way to map from my IP to my identity protects that in many ways, but data-mining at scale, knowing how many users connecting to one proxy server from city X, would be worth something to advertising and related companies who are more interested in large habits of users. If it turns out no one uses the pirate bay anymore, but use torrent site XYZ, I know where I'd place my advertising dollars for, say, a VPN product. This is on the extreme end, but you asked for a fun challenge! :)
    - kfreds 2y ago
      Thanks! :) I should've been more clear. The questions I posed above are rhetorical. I've spent well over half a decade obsessing over them. See my mention of System Transparency, Sigsum and Tillitis elsewhere in this thread.
      - fragmede 2y ago
        Thank you for your hard work. You've spent way more time on the problem than I. Didn't realize it was rhetorical! Mostly I wanna see homophobic encryption happen in practice. :p
selectodude 2y ago
There are billboards for Mullvad all over Chicago which kind of weird me out.
- ziddoap 2y ago
  They do traditional advertising (billboards being one example) instead of paid reviews, affiliate/influencer advertising, etc. https://mullvad.net/en/help/policy-reviews-advertising-and-affiliates https://mullvad.net/en/help/policy-reviews-advertising-and-a...
  - neuronexmachina 2y ago
    Oh wow, I wish more companies had pages like that summarizing what sort of marketing/advertising they do/don't use.
    - ziddoap 2y ago
      I’m fanboying at this point, but I honestly believe Mullvad should be the poster child for a lot of things other companies should be doing. Transparency, accountability, data minimization, thorough documentation, publicly available audits, etc.
      - hughesjj 2y ago
        I've been a happy expressvpn customer since dec 2016 but I'm sincerely considering switching to mullvad at this point
- nick238 2y ago
  [flagged]
  - ziddoap 2y ago
    Holy unsubstantiated accusations, batman. This can be instantly disproved by examining the cases where valid warrants were presented to them by LEAs and they were unable to provide any user data.
wepple 2y ago
They’re in it for the money. They’ve made some claims that are downright lies, I chuckle at the idea anyone would trust them. The NYC subway ads state that they save you from online web ad systems; blatantly false. I’ll take a photo next time I see the ad to store away.
- cjaybo 2y ago
  > They’ve made some claims that are downright lies Which claims are you referring to?
  - wepple 2y ago
    From my above post: > The NYC subway ads state that they save you from online web ad systems; blatantly false.
  - wepple 2y ago
    NYC subway, today: https://ibb.co/v3rdHcm https://ibb.co/v3rdHcm
- Rastonbury 2y ago
  What were the lies?
  - wepple 2y ago
    From my above post: > The NYC subway ads state that they save you from online web ad systems; blatantly false.
    - fooqux 2y ago
      A very cursory search online shows that it's actually your statement which is blatantly false. They've offered ad blocking for years. While it's true they've not always offered this, it's on you when making such claims to ensure you're still factual.
      - 2y ago
ph0ny 2y ago
They are making bank. Thank you open Swedish data: https://www.allabolag.se/5592384001/mullvad-vpn-ab https://www.allabolag.se/5592384001/mullvad-vpn-ab

Groxx 2y ago

Not everyone telegraphs if they're in it for the money. In some lines of business, like (purely hypothetically) security, it might actually be a bad thing for your business if you do. I also use mullvad because I don't really think this is the case, but bad actors are generally hard to conclusively identify by design. And VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior.

reaperman 2y ago
I think legally they would have to change their ownership directive document in Switzerland to allow the board of directors to allow the two founders to sell more than 50% of their shares. So you might get a heads up!
- blowfish721 2y ago
  They arent based in Switzerland but in Sweden.
yencabulator 2y ago
Mullvad is trying pretty darn hard to be as far from "just trust me bro" as is feasible. If you do take their word for how they run their systems (/are working toward), their servers are diskless (what logs?), will only run software signed by their infrastructure team, and will remotely attest that their software has not been tampered with. This is so very, very, far away from the typical VPN company that any such comparison sounds ridiculous to me. Just the pretense of doing all this work costs so much that a greedy biz bro simply wouldn't. https://github.com/mullvad/system-transparency https://github.com/mullvad/system-transparency https://www.system-transparency.org https://www.system-transparency.org https://news.ycombinator.com/item?id=29903695 https://news.ycombinator.com/item?id=29903695
- kfreds 2y ago
  Thank you for noticing! System Transparency is taking way longer to figure out, design and build than I expected. On the other hand the project is quite ambitious, and our work on ST has sprouted two additional OSS projects: - https://www.sigsum.org https://www.sigsum.org (a transparency log with witness cosigning) - https://tillitis.se https://tillitis.se (an open-source hardware FPGA-based security key with measured boot)
- fragmede 2y ago
  > a greedy biz bro simply wouldn't. On the other hand, if it were an NSA honeypot, doing all that work would easily be worth the cost. Personally, I don't think they are, so I'm merely pointing out that there are angles other than totally above-board honest legitimate reasons, and "greedy biz bro".
  - yencabulator 2y ago
    For sure. Them being Swedes with a long track record decreases that probability a lot.
kfreds 2y ago
> VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior. Yes. It is quite an interesting situation, really. It's also a fun challenge! To what extent can we prove that we are trustworthy, and using what tools? Do those tools exist or do we have to invent them?
- fragmede 2y ago
  You'd have to invent this one at least, as it currently doesn't exist. As the DNS server operator, you can view all my DNS queries. In a zero-trust environment where I don't trust you not to log all user queries and forwards them to the NSA, you'd need to use homomorphic encryption and create a DNS client and server than can do a lookup, without you, the DNS server operator, from finding out what the DNS lookup was of. https://github.com/menonsamir/spiral-rs https://github.com/menonsamir/spiral-rs claims to have implemented this at a level that's practical for real world applications, with a demo for a wikipedia server, but it's far too slow, as demoed, for use as DNS server. Now, the fact of the matter is that you can map my account ID back to the IP I'm connecting from, but with very limited way to map from my IP to my identity protects that in many ways, but data-mining at scale, knowing how many users connecting to one proxy server from city X, would be worth something to advertising and related companies who are more interested in large habits of users. If it turns out no one uses the pirate bay anymore, but use torrent site XYZ, I know where I'd place my advertising dollars for, say, a VPN product. This is on the extreme end, but you asked for a fun challenge! :)
  - kfreds 2y ago
    Thanks! :) I should've been more clear. The questions I posed above are rhetorical. I've spent well over half a decade obsessing over them. See my mention of System Transparency, Sigsum and Tillitis elsewhere in this thread.
    - fragmede 2y ago
      Thank you for your hard work. You've spent way more time on the problem than I. Didn't realize it was rhetorical! Mostly I wanna see homophobic encryption happen in practice. :p

selectodude 2y ago

There are billboards for Mullvad all over Chicago which kind of weird me out.

ziddoap 2y ago
They do traditional advertising (billboards being one example) instead of paid reviews, affiliate/influencer advertising, etc. https://mullvad.net/en/help/policy-reviews-advertising-and-affiliates https://mullvad.net/en/help/policy-reviews-advertising-and-a...
- neuronexmachina 2y ago
  Oh wow, I wish more companies had pages like that summarizing what sort of marketing/advertising they do/don't use.
  - ziddoap 2y ago
    I’m fanboying at this point, but I honestly believe Mullvad should be the poster child for a lot of things other companies should be doing. Transparency, accountability, data minimization, thorough documentation, publicly available audits, etc.
    - hughesjj 2y ago
      I've been a happy expressvpn customer since dec 2016 but I'm sincerely considering switching to mullvad at this point
nick238 2y ago
[flagged]
- ziddoap 2y ago
  Holy unsubstantiated accusations, batman. This can be instantly disproved by examining the cases where valid warrants were presented to them by LEAs and they were unable to provide any user data.

wepple 2y ago

They’re in it for the money. They’ve made some claims that are downright lies, I chuckle at the idea anyone would trust them. The NYC subway ads state that they save you from online web ad systems; blatantly false. I’ll take a photo next time I see the ad to store away.

cjaybo 2y ago
> They’ve made some claims that are downright lies Which claims are you referring to?
- wepple 2y ago
  From my above post: > The NYC subway ads state that they save you from online web ad systems; blatantly false.
- wepple 2y ago
  NYC subway, today: https://ibb.co/v3rdHcm https://ibb.co/v3rdHcm
Rastonbury 2y ago
What were the lies?
- wepple 2y ago
  From my above post: > The NYC subway ads state that they save you from online web ad systems; blatantly false.
  - fooqux 2y ago
    A very cursory search online shows that it's actually your statement which is blatantly false. They've offered ad blocking for years. While it's true they've not always offered this, it's on you when making such claims to ensure you're still factual.
    - 2y ago

ph0ny 2y ago

They are making bank. Thank you open Swedish data: https://www.allabolag.se/5592384001/mullvad-vpn-ab https://www.allabolag.se/5592384001/mullvad-vpn-ab